Total
304 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-7548 | 1 Schneider-electric | 14 Acti9 Powertag Link, Acti9 Powertag Link Firmware, Acti9 Powertag Link Hd and 11 more | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version information) that could allow unauthorized users to login. | |||||
| CVE-2020-7241 | 1 Wpseeds | 1 Wp Database Backup | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL. | |||||
| CVE-2020-5408 | 2 Pivotal Software, Vmware | 2 Spring Security, Spring Security | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack. | |||||
| CVE-2020-5365 | 1 Dell | 1 Emc Isilon Onefs | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC Isilon OneFS installation. This account is used for diagnostics and other support functions. Although the default password is different for every cluster, it is predictable. | |||||
| CVE-2020-4188 | 1 Ibm | 1 Security Guardium | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends on unpredictable numbers. IBM X-Force ID: 174807. | |||||
| CVE-2020-36732 | 1 Crypto-js Project | 1 Crypto-js | 2024-11-21 | N/A | 5.3 MEDIUM |
| The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary. | |||||
| CVE-2020-36252 | 1 Owncloud | 1 Owncloud | 2024-11-21 | 2.7 LOW | 6.8 MEDIUM |
| ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number. | |||||
| CVE-2020-35926 | 1 Nanorand Project | 1 Nanorand | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled. | |||||
| CVE-2020-35685 | 2 Hcc-embedded, Siemens | 5 Nichestack, Sentron 3wa Com190, Sentron 3wa Com190 Firmware and 2 more | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.) | |||||
| CVE-2020-35163 | 2 Dell, Oracle | 6 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Database and 3 more | 2024-11-21 | 7.5 HIGH | 5.3 MEDIUM |
| Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Values Vulnerability. | |||||
| CVE-2020-2099 | 1 Jenkins | 1 Jenkins | 2024-11-21 | 7.5 HIGH | 8.6 HIGH |
| Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents. | |||||
| CVE-2020-27743 | 1 Pam Tacplus Project | 1 Pam Tacplus | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id. | |||||
| CVE-2020-27636 | 1 Microchip | 1 Mplab Network Creator | 2024-11-21 | N/A | 9.1 CRITICAL |
| In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random. | |||||
| CVE-2020-27635 | 1 Capgemini | 1 Picotcp | 2024-11-21 | N/A | 9.1 CRITICAL |
| In PicoTCP 1.7.0, TCP ISNs are improperly random. | |||||
| CVE-2020-27634 | 1 Contiki-ng | 1 Contiki-ng | 2024-11-21 | N/A | 9.1 CRITICAL |
| In Contiki 4.5, TCP ISNs are improperly random. | |||||
| CVE-2020-27633 | 1 Butok | 1 Fnet | 2024-11-21 | N/A | 9.1 CRITICAL |
| In FNET 4.6.3, TCP ISNs are improperly random. | |||||
| CVE-2020-27631 | 1 Oryx-embedded | 1 Cyclonetcp | 2024-11-21 | N/A | 9.8 CRITICAL |
| In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random. | |||||
| CVE-2020-27630 | 1 Silabs | 1 Uc\/tcp-ip | 2024-11-21 | N/A | 9.8 CRITICAL |
| In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. | |||||
| CVE-2020-27556 | 1 Basetech | 2 Ge-131 Bt-1837836, Ge-131 Bt-1837836 Firmware | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device. | |||||
| CVE-2020-27264 | 1 Sooil | 6 Anydana-a, Anydana-a Firmware, Anydana-i and 3 more | 2024-11-21 | 3.3 LOW | 8.8 HIGH |
| In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low Energy. | |||||